What caralegal does

caralegal GmbH is a Berlin-based B2B SaaS company that operates a "Data Responsibility Platform" for European data protection and AI governance compliance. The platform is organized into four integrated modules — Privacy Flow (GDPR/DSGVO record of processing, DPIAs, data subject requests, breach management), AI Flow (EU AI Act risk classification, AI registers, technical documentation), Audit & Vendor Flow (customizable questionnaires, interview-mode audits, third-party assessments), and Risk Flow (risk identification, assessment, treatment and heatmaps) — delivered as a web application hosted on Open Telekom Cloud infrastructure in Frankfurt, Germany, under ISO/IEC 27001 certification.

The product was founded in 2020 as a spin-off from ISiCO Datenschutz GmbH, a privacy consulting firm, and SCHÜRMANN, ROSENTHAL, DREYER, an IT law firm, both based in Berlin. This origin gives the platform codified regulatory expertise in GDPR, the EU AI Act, Swiss nDSG, German Standard-Datenschutzmodell (SDM), and Catholic Kirchliches Datenschutzgesetz (KDG). AI-assisted features include the 'cara28' AVV reviewer, automatic 28+ language translation, automatic DPIA threshold analysis, and a Cookie Check module that simulates website visits for compliance scanning. The company reports a 2-day implementation time, a 64% reduction in documentation effort, and a 9.5/10 customer recommendation score.

Commercially, caralegal sells annual subscriptions through a four-tier structure — Essential (€79/month), Professional (€349/month), Corporate (€749/month), and Enterprise (custom) — plus an AI-Act Pioneer tier and a combined Data Protection + AI-Act Pioneer package, with a 50% non-profit discount. GTM is sales-led, enterprise-oriented, supported by direct website sales, demo bookings, and a partner program for external data protection officers and consultancies. Named customers include ProSiebenSat.1 Media SE, RWE, Aramark, Flughafen Berlin Brandenburg, Elisabeth Vinzenz Verbund, Eurofiber, ITV Studios Germany, Onefootball and Bridgemaker, spanning media, energy, infrastructure, healthcare, telecommunications and startup segments.

Name

caralegal

Legal name

caralegal GmbH

Website

https://caralegal.eu

Company type

Private

Founded year

2020

Operating status

Operating

Headcount range

101–250 employees

Short description

caralegal GmbH is a Berlin-based B2B SaaS vendor of a Data Responsibility Platform for GDPR and EU AI Act compliance, serving enterprise, mid-market, and scaleup customers across Europe with four integrated flows (Privacy, AI, Audit & Vendor, Risk).

Ownership category

akta.pro rank

Product category

Privacy and Data Protection Compliance Software

NAICS

Software Publishers (5132)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

Data Strategy & Governance Services (BPAEAHAA)

Keywords

• Data protection software
• GDPR compliance platform
• AI governance software
• Privacy management SaaS
• Data responsibility platform

Headquarters

HQ city

Berlin

HQ country

Germany

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations

Revenue model

1. Subscription-based SaaS Licensing: caralegal generates revenue primarily through subscription-based SaaS licensing with tiered pricing packages. The company offers four main tiers: Essential (€79/month), Professional (€349/month), Corporate (€749/month), and Enterprise (custom pricing). Additional revenue streams include add-on modules for translation tools, employee training, online legal databases, premium templates, data subject request workflows, and cookie checking. The AI-Act Pioneer package provides dedicated AI governance capabilities at custom pricing. All tiers include unlimited users and documents, with differentiation based on number of legal entities, language support, and feature depth. The subscription model includes annual billing with volume-based discounts for non-profit organizations (50% reduction).

Pricing tiers

Go-to-market motion2 records

Distribution channels2 records

Marketing channels7 records

Core offering

caralegal sells a B2B SaaS "Data Responsibility Platform" that bundles four integrated software modules — Privacy Flow (GDPR/DSGVO records of processing, DPIA, data subject requests, breach management), Risk Flow (risk identification, assessment and treatment with heatmaps), Audit & Vendor Flow (customizable audit questionnaires and vendor management) and AI Flow (EU AI Act governance, AI registry and risk classification) — delivered as a web application hosted on Open Telekom Cloud in Frankfurt, Germany and sold via tiered annual subscriptions (Essential, Professional, Corporate, Enterprise) plus the AI-Act Pioneer add-on.

Product overview

caralegal is a B2B SaaS Data Responsibility Platform comprising four integrated modules: Privacy Flow (core GDPR compliance management), AI Flow (EU AI Act governance), Audit & Vendor Flow (audit management), and Risk Flow (risk assessment). The platform supports complex multinational and multi-entity structures with 30+ languages, hosted on German private cloud infrastructure. Pricing spans four main tiers (Essential €79, Professional €349, Corporate €749, Enterprise custom) plus AI-Act Pioneer add-on for proactive AI governance compliance.

Differentiator

Problem solved

Functional benefit

Products and services

• Privacy Flow Data protection management software for GDPR/DSGVO compliance covering record of processing activities (Art. 30), data protection impact assessments, technical and organisational measures, data subject requests, deletion concepts, and data breach management. Designed for enterprise and mid-market customers needing cross-departmental, audit-ready documentation.
• AI Flow AI governance and compliance software for EU AI Act implementation, including an AI application directory, AI risk management, technical documentation, user instructions, information and transparency obligations, and data governance. Built for companies needing to operationalize AI Act obligations across provider and operator roles.
• Audit & Vendor Flow Customisable audit management software with template and questionnaire editor, audit assistance, interview-mode audits, internal and external audit questionnaires, audit result management, automatic reporting, and vendor reporting capabilities. Targets organizations needing structured third-party and internal compliance audits.
• Risk Flow Risk management software for data protection and AI risks, covering risk identification, mapping to processing activities and DSFA, risk assessment, risk treatment, linking to technical and organizational measures and warranty objectives, risk matrices/heatmaps and asset management.
• AI-Act Pioneer package Dedicated subscription package for early-mover AI governance and compliance under the EU AI Act, including AI application directory, AI risk management, technical documentation, user instructions, information and transparency obligations, data governance, Risk Flow, and a dedicated Customer Success Manager. Available as a standalone package or combined with the Data Protection package.
• Cookie Check module Automated website cookie compliance checking module that scans entire websites, simulates bot visits, categorizes cookies found, identifies cookies deployed without consent, and provides regular monitoring updates to reduce regulatory fine risk. Sold as an add-on to the Privacy Flow subscription.

Quantifiable outcome

• 64% reduction in documentation effort
• +3 more outcomes

Named customers9 records

Segments5 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

AI capability5 records

Feature9 records

Partnerships

Three partnerships are on record, tiered core.

• ISICO GmbH (now ISiCO Datenschutz GmbH)coreStrategic or Co-development Partnercaralegal is a spin-off from ISiCO Datenschutz GmbH, a renowned data protection consulting firm. The founding relationship provides deep legal expertise and domain knowledge that informs the software's design and regulatory compliance capabilities.
• SCHÜRMANN, ROSENTHAL, DREYER Partnerschaft von Rechtsanwälten mbB (SRD)coreStrategic or Co-development Partnercaralegal originated from the IT law firm SRD (Schürmann, Rosenthal, Dreyer), providing legal technology expertise and regulatory knowledge. This founding partnership combines legal practice with software development capabilities.
• Open Telekom Cloud (T-Systems International GmbH)coreTechnology or IntegrationInfrastructure hosting partnership with Deutsche Telekom's Open Telekom Cloud for data center services in Frankfurt, Germany. This partnership ensures compliance with German data protection requirements and EU data residency regulations.

Scale indicators5 records

Recent moves7 records

Expansion highlights6 records

Broad incumbents

• Collibra: Large enterprise data intelligence and governance platform with privacy and AI governance extensions. Broader and more established than caralegal, serving similar enterprise data/privacy buyers but as part of a wider data catalog stack.

Direct peers

• Usercentrics: Munich-based consent management platform with extended privacy and AI governance capabilities. Closest German peer to caralegal, competing for the same European enterprise and Mittelstand privacy software budget.
• TrustArc: Privacy management and compliance platform offering privacy program management, consent, and assessment tools. Direct competitor in the privacy/GDMR management space with similar enterprise target customers.
• OneTrust: US-based privacy, security, and governance software platform with a very large enterprise footprint. Directly comparable to caralegal across consent, privacy management, and increasingly AI governance, though OneTrust is significantly larger and more broadly positioned.
• Securiti: Unified data security and privacy platform combining data intelligence, consent, and AI governance. Direct peer for caralegal's combined privacy + AI governance offering with a more data-discovery-centric approach.
• BigID: Data intelligence platform for privacy, security, and governance with deep data discovery and classification. Directly comparable in the data protection management category, especially for enterprises needing data-centric privacy controls.
• DataGuard: Munich-based privacy and information security compliance platform serving European mid-market and enterprise. Closest direct European peer to caralegal, with overlapping GDPR, ISO 27001, and AI governance offerings.

Emerging players

• Ethyca: Privacy engineering platform focused on developer-centric privacy automation and AI governance. Emerging peer with a more engineering-led approach, competing in the AI governance subsegment caralegal entered with AI Flow.
• Cookiebot: Cookie consent and compliance scanning platform (owned by Usercentrics). Comparable for the cookie compliance use case, which is one feature within caralegal's broader platform.
• Didomi: Consent management platform (CMP) with privacy and preference management capabilities. Adjacent peer that overlaps with caralegal's privacy flow and cookie compliance, with narrower scope.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/caralegal
• Xx.com/caralegal_gdpr

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about caralegal